Privacy Policy

Privacy Policy

Last Updated: March 12, 2023

‍Terms For Nebula Account

At Nebula Genomics we value your privacy and strive to offer you informed choices that allow you to control the privacy of your Personal Information (as defined below). This Privacy Policy (“Policy”) explains our collection, use, and disclosure of Personal Information. This Policy applies to Nebula Genomics, Inc. and to our controlled affiliates and subsidiaries (“Nebula”, “we”, “our”, or “us”).

References to our “Services” in this Policy include our websites, apps, software, and related services. This Policy applies to our products that display or reference this Policy. This Policy however does not apply to any third-party products that display or reference a different privacy policy.

By using our Services, you are agreeing to this Policy and you provide your informed and explicit consent to the uses of your Personal Information (defined below) including your Genetic Data. This Policy notifies you of the use of your Personal Information and by proceeding to use our Services you confirm your understanding of its terms.

  1. Summary

This Policy explains what Personal Information we collect and how we use, maintain, disclose, and in certain cases, transfer your Personal Information. This Section provides an overview of our data practices.

At Nebula, we value your privacy and aim to provide you with clear and informed choices about your Personal Information. In order to provide our DNA testing services, we collect Personal Information about you that includes information such as:

  • your name, contact information, age, and gender;
  • your personal health history and other personal history data;
  • Genetic Data (as defined below) extracted from the sample provided by you.
    ‍

We treat your Personal Information with great care and use this data to provide you the requested DNA testing and reporting services, to improve our products and services, and to communicate with you, including marketing and advertising communication, unless you opt-out, and for any other purposes, such as research, to which you choose to opt-in.

To accomplish some of those uses, we may disclose your Genetic Data to third parties that we partner with, such as our partner laboratories. If you chose to participate in scientific research, we may also disclose your Genetic Data to those third parties that we partner with to conduct such research. We will never disclose your Genetic Data for research purposes without you first choosing to participate in such research. Finally, if we are required by law, such as by court order or subpoena, we may share your Genetic Data with law enforcement. We do not disclose your Genetic Data to any law enforcement agency, unless we are legally required to do so.

We will not provide any data (genetic or non-genetic) to an ​insurance company​ or ​employer​.

  1. Definitions

“Personal Information” means any information that identifies, relates to, describes, or is reasonably capable of being associated, linked or linkable with a particular individual or household, including any information that is subject to applicable data protection laws. Personal Information includes User Data, Survey Data, and Genetic Data (defined below).

“User Data” means all Personal Information that is not Survey Data or Genetic Data. This typically will include basic profile information such as name, email address, mailing address, phone number, as well as other data collected from a user’s interactions with us, such as order history, payment information, and communication preferences.

“Survey Data” includes the voluntarily provided basic personal data, such as sex, age, ethnicity, weight, and height that a user may provide when responding to a survey. This also includes behavioral and social information such as a user’s occupation, commute, diet, alcohol consumption and tobacco use, fitness and exercise, and sleep behavior. Some surveys may collect more detailed information about a user’s present or past physical or mental health, medical conditions, diseases, and symptoms and other medical information.

“Genetic Data” is the data that we collect from users in order to provide the Services. For example, a user may submit a saliva sample. DNA is then extracted from their saliva at Nebula (or partner) labs and is converted to a machine-readable code (“DNA Data”) which is used to provide the Services. DNA test kit code, year of birth, and sex may also be collected for activation purposes.  Genetic Data does not include de-identified data.

“Applicable Laws” refers to the various privacy laws that apply or govern the collection, use, and disclosure of Personal Information. Without limitation, Applicable Laws specifically includes the California Consumer Privacy Act (“CCPA”) and all amendments thereto, including the California Privacy Rights Act (“CPRA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Virginia Consumer Data Protection Act (“VCDPA”), Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (“GDPR”), the California Genetic Information Privacy Act (“GIPA”), and various other state laws applicable to the collection of Personal Information.

  1. Categories and Sources of Data

Through your use of the Services and in order to provide the Services requested, we may collect the below listed categories of Personal Information. We collect information about you from different sources and in various ways when you use our products, including information you provide directly, information we collect automatically, information from third-party sources, and data we infer or generate from other data.

‍

Information CategoryDescriptionThe following are a non-exhaustive list of data points collected under each categorySource
User DataYour NameYour EmailAccount PasswordPhone NumberShipping and Billing addressCredit card informationDNA Test Kit CodeDirectly from you
Information you provide when interacting with us by email, phone call, via Nebula Support or through other methods of communication. This also includes your preferences for receiving communications about our activities, events, and publicationsAutomatically collected technical and usage data (device’s operating system, Internet Protocol (IP) address, access times, browser type and language, the website you visited before our site, and your activity on our websites.Collected automatically by third party services and toolsFrom third parties we partner with
Survey DataSex, age, ethnicity, weight, and heightBehavioral and social information such as your occupation, commute, diet, alcohol consumption and tobacco use, fitness and exercise and sleep behaviorInformation about your present or past physical or mental health, medical conditions, diseases and symptoms and other medical informationDirectly from you
Genetic DataDNA extracted from your biological sample at one of our partner labs is converted to a machine-readable codeDirectly from youCreated or generated by us
  1. Use of Data

‍We use your Personal Information to provide, personalize, analyze, and improve our Services and as otherwise described in this Policy or otherwise disclosed to you. The specific uses differ and vary based upon the categories of data and your permissions.

  1. User Data

‍We use your User Data as necessary to provide the Services, to improve our Services, and for other activities related to the Service. These activities include, among other things, to:

  1. Open your account and process your payments; 
  2. Enable the use of our website including authentication of your site visits, providing personalized content, and personalizing your use of the Services;
  3. Build new Services and improve existing Services;
  4. Provide customer support and respond to your questions;
  5. Communicate with you about purchases, your account and any relevant information about our Services (e.g. product updates, policy changes or security issues);
  6. Enforce our Terms of Service or any other agreements between you and Nebula;
  7. Detect, investigate, and protect against prohibited or illegal behaviors on our Services including combatting spam and other security risks; 
  8. Perform research and development activities using data that can no longer identify you byname, for the purpose of conducting statistical data analysis and scientific research;
  9. Contact you about research opportunities and obtain your research consent; and
  10. Market new products and offers from Nebula and our partners as well as providing personalized advertising to you based off of your interests. In carrying out these purposes, we may combine User Data we collect from different sources to give you a more seamless, consistent, and personalized experience.
  11. Survey Data

If you choose to provide Survey Data to us, we will use that data to provide the Services you requested. We also use Survey Data to improve our Services. We may also use Survey Data to perform research including:

  1. Aggregated analysis of Survey Data;
  2. Study and derive patterns from Survey Data;
  3. Study and analyze patterns between Survey Data and Genetic Data;
  4. To allow you to participate in research conducted by our third-party research partners.
  5. Genetic Data

We only use your Genetic Data to process, analyze, and deliver your genetic results as part of the Services you request. We only process Genetic Data pursuant to your affirmative opt-in consent. To receive results from our Services you must first create a Nebula account, register your DNA Test kit, and submit your saliva sample to our laboratories or our partner laboratories which then analyze your samples and provide us with the resulting data. Nebula uses your Genetic Data for these primary purposes: 

  1. Analyze Genetic Data to provide you with information about:
  1. your ancestry and ethnicity;
  2. the makeup of your oral microbiome;
  3. other insights into what your DNA reveals about your traits, personal health, and wellness, based on this information we may also invite you to participate in certain surveys which are entirely optional.
  1. Customize the Nebula Library according to genetic profile;
  2. Study aggregated, de-identified (or pseudonymized) Genetic Data to provide more accurate ancestry results, oral microbiome, and polygenic score percentiles;
  3. Improve features and functionality in our existing Services, as well as build new products to add to our Services and ultimately better serve you.

If you opt in to optional research, to analyze Genetic Data to conduct scientific, statistical, and historical research (in which case we will provide you with separate notice with an opportunity to consent, if required by applicable laws). Your participation in research is completely voluntary, and we ask for consent from you during your enrollment and registration process prior to using your Genetic Data for any research purposes unrelated to providing the Services.

  1. Sharing with Third Parties

Nebula is committed to transparency in the third parties we share your information with, and to giving you certain control over when and how your Personal Information is shared. We will only share your Personal Information in accordance with Applicable Laws, as disclosed in the Policy, or as authorized by you.

We may share your Personal Information with the following categories of third parties:

  • Order fulfillment and shipping service providers
  • Partner laboratories
  • Customer support service providers
  • Information Technology service providers
  • Marketing and analytics service providers

Similarly, we do not sell or share any Personal Information for a third party’s cross-context behavioral advertising. We have included more information on how we may share Personal Information with third parties below, depending on the type of data:

  1. User Data

We share your User Data as necessary to provide the Services you request. Specifically, we may need to share your User Data for the following purposes and with the following third parties:

  1. Order Fulfillment

In order to provide you the Services you requested, we may need to ship the DNA Testing Kit to you and you will need to ship the DNA Testing Kit to us. We engage third party service providers to fulfill shipment and delivery requests and we share your User Data, as may be necessary, with those third parties. This may include your name, mailing address, email address, phone number, order number, and DNA Test Kit Code.

  1. Perform Requested Sharing Services

As part of our Services, you have the option to share your User Data with others through sharing features in the Services. This includes, but is not limited to, sharing your reports or ancestry information with others on social media platforms such as Facebook. If you decide to share details about your ancestry, traits, or any other information through these sharing features, you do so at your own risk. We encourage you to review the privacy policies of these third parties before using these features.

  1. Our Partner Laboratories

Depending on the Services you request, we may need to collect and process your DNA sample. We partner with third party laboratories to extract your DNA from your DNA sample, such as your saliva, which we then convert to a machine-readable code which is used to provide our Services. To properly extract your DNA from the sample, we may need to share certain User Data with the third parties, including your name, DNA Testing Kit Code, and other information as may be necessary.

  1. Customer Support

To ensure the continued satisfaction with our Services, we may also partner with certain third parties to provide customer support services. Our customer satisfaction teams may use certain tools to process and respond to your requests and we may need to share your User Data as part of that process.

  1. Information Technology

As needed, we may share your User Data with our IT providers who provide services that ensure the proper functionality and security of our Services.

  1. Marketing and Analytics

When you use or interact with our Services, we work with third parties who provide certain marketing and analytics services. For example, we may work with a third party service provider to collect information about your visit to the website such as the links you click and pages you read. We may share your User Data with such third parties in order to recognize you as an existing user.
‍

We also work with third parties on various marketing campaigns and promotions and we may share  your User Data (but not Survey or Genetic Data) with such third parties to contact you about our Services. You will always have the ability to opt-out of marketing communication.
‍

When we share User Data for marketing or analytics purposes, we only share the data for limited purposes and we prohibit those third parties from using or disclosing your User Data for their own (or another third party’s) marketing purposes. 

  1. As Required By Law

We may be required to share your User Data by law, such as by a lawful court order or subpoena. If we are required by law to share your User Data, we will attempt to provide you with notice prior to disclosing your data, unless we are prohibited by law from doing so. Absent a lawful court order or other law requiring us to disclose your User Data, we do not voluntarily disclose your Personal Information with any law enforcement agency.

  1. Business Transactions

We may also disclose your User Data with third parties as it may be necessary to complete a business transaction involving Nebula, such as a merger or acquisition of Nebula, or a sale of all or a portion of the Nebula business or assets. In such a case, your Personal Information would remain subject to the promises made in this Policy.

  1. Survey and Genetic Data

We disclose your Survey Data and Genetic Data only with your explicit, prior consent. We may ask for permissions to disclose your Survey Data and Genetic Data with the following third parties:

  1. Partner Laboratories

In order to provide the Services we may need to work with one of our partner laboratories. If we work with such a third party partner, we will need to share your Genetic Data with the partner laboratory. Specifically, we will need to share your DNA sample with the third party laboratory who will then process it and extract the DNA Data that we need to provide the Services. When we use a partner laboratory to process your Genetic Data, we do so only with vetted and pre- approved third party laboratories who have a contractual relationship with Nebula. All Genetic Data shared with third party laboratories is shared only for a limited and specified purpose, and remains in our control, and cannot be shared for any other purposes by the laboratory.

  1. Researchers

At Nebula, we believe that genetic research is crucial to our deeper and better understanding of the human genome and we aim to continue to conduct genetic research in meaningful ways. From time to time, we may offer you the ability to participate in research. Your participation is completely voluntary and your access to the Services will not be impacted whether you choose to participate in research or not.

  1. United States Research

If you are located in the United States, we will only use Genetic Data that can personally identify you for research if you give us your affirmative consent. To participate in research, US based users must first consent to be in the Research Pool. You can find this consent form here for US and here for EU. Your participation in the Research Pool does not give us consent to use your Personal Information for any research. Rather, it lets us know that you are interested in being contacted about specific research opportunities. When a specific research opportunity arises, we will then contact the users in the Research Pool with detailed information about each and specific research opportunity, which will include details about that research. You will then have the option to consent to the use of your Personal Information for that research.

You can view the current research projects by visiting our research page. You can revoke your consent to participate in research. To change your research consent settings, please visit portal.nebula.org. Your decision to revoke consent will not impact your Services. In compliance with the applicable US laws, we may use de-identified data, including genetic or phenotypic information, for research purposes without any additional consent or authorization, but this data is not personally identifiable.  We will not share Genetic Data that can personally identify you without your consent.

  1. EU/UK Research

If you are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”), we will not use any of your Personal Information, including your Genetic Data and any information you provide in response to surveys or otherwise uploaded to your account or shared to us through the use of our websites and Services, for research without your informed and explicit consent.

The types of research projects we anticipate conducting ourselves or with other non-profit organizations, researchers, physicians, academic institutions, other DNA testing companies or life sciences (pharmaceutical and medical device) companies (“Research Partners”) include:

  1. Studies related to population structure, demography, genetic variations, and migration patterns.
  2. Studies related to human lifestyle and genetic markers related to diagnostics and medical conditions.
  3. Studies related to developing treatments and response to certain therapeutics.
  4. Studies related to the genetics of diet, sleep, mental health, and fitness.

‍

You can find out more information about our research and consent to participate by visiting our research page.

If you consent to participate in research, we will only share research results which do not identify you by name, email, address or other information that identifies you directly.  Research results are only based on de-identified, pseudonymized, or aggregated data.

You can withdraw your consent from participating in research at any time. To change your research consent settings, please email us at legal@nebula.org. Your decision to withdraw your consent will not impact your ability to use our websites and Services.

  1. De-Identified Data

We may use Personal Information in our possession to create de-identified and aggregated data sets. In other words, some of the data that we collect from you is stripped of all information that may be used to identify an individual by name. We may then use this de-identified or pseudonymized genetic or phenotypic information (such as Genetic Data), which may be shared with or disclosed to third parties for research purposes in accordance with Part 46 (commencing with Section 46.101) of Title 45 of the Code of Federal Regulations, or where you are located in a country in the European Economic Area, Switzerland or the UK, as permitted under the EU/CH/UK General Data Protection Regulations.

  1. Law Enforcement

Nebula will not voluntarily share your Survey Data or Genetic Data with law enforcement. However, under certain circumstances your Survey Data and/or Genetic Data may be subject to processing pursuant to laws, regulations or judicial or governmental orders, warrants or subpoenas. In other words, where we are legally compelled to disclosure your Personal Information to a governmental or regulatory authority. Nebula will not share any other categories of Personal Information, other than what is required to protect the safety of persons or property, or in enforcing our, our affiliates, or our partners’ legal rights. For example, if a user defrauds our Services, we may disclose that user’s Personal Information (but not Genetic Data) with law enforcement in an effort to recuperate the defrauded costs. If we are compelled to disclose your Personal Information, we will do our best to provide you with advance notice, unless we are prohibited under law from doing so.

  1. Business Purposes

In the event that Nebula is acquired or transferred including in connection with corporate transaction, bankruptcy, or similar proceedings (including financing, merger, acquisition, dissolution, or a transfer, divestiture, or sale of a portion or all of our business or assets), we will share your Survey Data and Genetic Data with the acquiring or receiving entity as a part of the transaction or negotiation for such a transaction. Nonetheless, the promises of this Policy will continue to apply to your Personal Information that is transferred to the new entity. Any new entity will only be allowed to use your User Data, Survey Data, and Genetic Data pursuant to this Policy, or as otherwise authorized by you.

  1. Data Retention Policies

We retain your Personal Information for as long as necessary to provide the products and fulfill the transactions you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes. Because these needs can vary for different data types in the context of different products, actual retention periods can vary significantly based on criteria such as user expectations or consent, the sensitivity of the data, the availability of automated controls that enable users to delete data, and our legal or contractual obligations. For example, all of the data collected by Google Analytics for the purposes of understanding our website usage is automatically deleted after 26 months, all mobile identifiers and cookie identifiers placed by Adroll expire and are then deleted after 13 months, and the Recent User Activity feed collected by Hotjar are retained for 1 year.

Nebula will store your Personal Information as long as your Account is open, unless you make a request for us to delete all or any of your Personal Information prior to the closing of your Account as described in this Policy. If you decide to close your Account, then Nebula will automatically destroy all Personal Information related to your account, including User Data, Survey Data, and Genetic Data. In specific circumstances such as by court order, subpoena, or other legal or regulatory obligations, however, Nebula may be required by law to store your Personal Information beyond the deletion of your Account or request for deletion of Personal Information. Nebula may also retain disaster recovery copies for a fixed period following this deletion, although this data will not be used for any purpose other than disaster recovery.

If you provide us with your biological sample, we use it to provide the Services, but will not store or retain such sample unless we first obtain your consent.

You may access and delete or change much of your Personal Information through your Account Settings here. Otherwise, any Personal Information that is not accessible in your Account Setting can be accessed and changed or deleted by reaching out to Legal@nebula.org.

  1. Maintenance and Security

Nebula maintains a comprehensive information security program designed to protect your Personal Information through the use of reasonable safeguards. Nebula has measures in place designed to protect against inappropriate access, loss, or misuse of Personal Information. For example, we use secure server software to encrypt Personal Information and work with data storage cloud partners that meet our security standards.

While we cannot guarantee that loss, access or misuse of data will not occur, we use reasonable efforts to prevent these outcomes. To help us protect Personal Information, we request that you use a strong password and never share your password with anyone or use the same password with other sites or accounts.

  1. Data Location and Transfer

We are a global business. Personal Information may be stored and processed in any country where we do business or our service providers do business. We may transfer your Personal Information to countries other than your own country, including to the United States. These countries may have data protection rules that are different from your country. When transferring data across borders, we take measures to comply with applicable data protection laws related to such transfer. Officials (such as law enforcement or security authorities) in those other countries may be entitled to access your Personal Information.

If you are located in the European Economic Area (“EEA”), the UK or Switzerland, we are directly regulated by the EU/CH/UK GDPR and your Personal Information will be transferred to the United States for processing by us.  We may need to transfer your Personal Information to third parties and will comply with applicable laws to provide an adequate level of data protection for the transfer of your Personal Information. Where we do transfer your Personal Information to third parties, including partners, we will ensure that your Personal Information is protected by appropriate cross-border transfer solutions to provide adequate protection.

Please contact us if you would like to learn about the specific transfer security mechanisms we use.

  1. Changes to This Privacy Statement

We will update this Policy when necessary to reflect changes in our products, how we use Personal Information, or the applicable law. When we post changes to the statement, we will change the “Last Updated” date at the top of the statement. If we make material changes to the statement, we will provide notice or obtain consent regarding such changes as may be required by law.

  1. Jurisdiction Specific Provisions
    1. Florida‍

Pursuant to Fla. Stat. § 760.40, upon your request, your Genetic Data is available to your physician. If you wish to share this data with your physician, you may download your raw Genetic Data in your account, or by clicking here.

  1. U.S. Consumer Data Rights

If you are a resident of the U.S., your state of residence may provide you additional rights regarding our use of your Personal Information. The rights that may be available to you include: 

Right to Know and Access

You may have a right to request information about our collection, use, and disclosure of your Personal Information, and ask that we provide you with certain information, such as:

  • Categories and specific pieces of Personal Information we have collected about you.
  • Categories of sources from which we collect Personal Information.
  • Purposes for collecting Personal Information.
  • Categories of third parties with which we share Personal Information.
  • Categories of Personal Information disclosed about you for a business purpose.
  • If applicable, categories of Personal Information sold about you and the categories of third parties to which the Personal Information was sold, by category or categories of Personal Information for each third party to which the Personal Information was sold.

You can access your Personal Information within your account settings and the Survey Data within the specific survey page. To make a verifiable request for information about the Personal Information we have collected about you, you may reach out to the Nebula team at Legal@nebula.org. Also, you may download your raw Genetic Data here. To the extent required under Applicable Laws, we will do our best to assist you without undue delay and within the time required by Applicable Laws. However, to the extent permitted by Applicable Law, we reserve the right to charge a fee or decline requests that are unreasonable or excessive, where providing the Personal Information would be prohibited by law or could adversely affect the privacy or other rights of another person, or where we are unable to authenticate you as the person to whom the Personal Information relates.

Right to Portability

You may have the right to request that we provide a copy of the Personal Information we have collected about you, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. Once we receive your request and confirm your identity, we will provide to you a copy of your Personal Information as required under Applicable Laws. We may provide this data to you through your user account with us, or via email to the email address you have provided with your request.

Right to Delete

You may also have a right to request that we delete your Personal Information, subject to certain exceptions. To make a verifiable request to delete the Personal Information we have collected about you, you may reach out to the Nebula team at Legal@nebula.org.

Right to Correct

Subject to certain exceptions, you may have the right to request that we correct inaccurate Personal Information that we have collected about you. Once we receive your request and confirm your identity, we will review your request, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information to see if we can correct the data. We may also request additional information showing that the Personal Information you want to correct is inaccurate. 

Right to Non-Discrimination

Your state may prohibit treating you different than other customers for exercising your rights regarding your Personal Information under Applicable Laws. This includes by denying or providing a different level or quality of goods or services, or charging (or suggesting that we will charge) different prices, rates, or impose penalties on residents of such states who exercise their  rights regarding their Personal Information, unless doing so is reasonably related to the value provided to us by your Personal Information.

Right to Opt-out 

You may have the right to opt-out of processing of your Personal Information for the purpose of (i) targeted advertising, (ii) sale or sharing of Personal Information, or (iii) profiling to provide you with tailored content, including suggested advertising. We do not process your Personal Information for the purpose of (i) targeted advertising, (ii) selling or sharing your Personal Information, or (iii) profiling, as those terms are defined under Applicable Laws.   

‍Requests Made Through Agents

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise the rights provided by your state of residence regarding your Personal Information. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

Do Not Track

Some browsers have incorporated “Do Not Track” (DNT) features that can send a signal to the websites you visit indicating you do not wish to be tracked. Because there is not a common understanding of how to interpret the DNT signal, our websites do not currently respond to browser DNT signals. Instead, you can use the range of other tools to control data collection and use.

  1. Additional rights for California Residents

Shine the Light

Where applicable, California Civil Code Section 1798.83 permits users of the websites that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request please contact us using the information provided in the “Contact Us” section below.

Financial Incentive Program

We do not offer any financial incentives as those are defined under the applicable data protection laws.

Limit the Use of My Sensitive Personal Information

To the extent that we process any Sensitive Personal Information, as that term is defined under Applicable Law, we will only do so if you have given us your explicit consent to carry out such processing and the processing is necessary to provide the Services requested. To the extent we use your Sensitive Personal Information for any other purpose, such as to improve the Services, we have done so pursuant to your opt-in consent. You have the right to request that we limit the use of your Sensitive Personal Information to only purposes necessary to provide the Services. You may exercise that right by sending us an email with “Limit the Use of My Sensitive Personal Information” in the subject line at: Legal@nebula.org.

Filing of a Complaint

  1. Effective January 1, 2022, California residents also have the right to file a complaint with the California Attorney General’s Office alleging violation of the Genetic Information Privacy Act. As the Attorney General’s Office releases additional information on how to file that Complaint, we will supplemental this Policy with that information, as required under the applicable law.
  2. Virginia and Colorado Residents

Right to Appeal

If you make a request to exercise any of the above data access rights and we are unable to comply with your request, you may request to appeal our decision. To appeal any data privacy request decision, please contact us by emailing Legal@nebula.org with the subject line “Data Access Request Appeal.” If after you complete the appeal process with us, you are still unsatisfied with our response, you may contact your Attorney General to file a complaint. Below are the contact information for the appropriate entity where you can inquire about filing an appeal: 

Virginia residents:

Office of the Attorney General

202 North 9th Street

Richmond, Virginia 23219

Phone: (804) 786-2071

https://www.oag.state.va.us/

Colorado residents:

Office of the Attorney General

Colorado Department of Law

Ralph L. Carr Judicial Building

1300 Broadway, 10th Floor

Denver, CO 80203

(720) 508-6000
https://coag.gov/

  1. Nevada Residents

Although we do not sell Personal Information (as defined in Chapter 603A of the Nevada Revised Statutes), Nevada residents have the right to submit a verified request directing us not to sell your Personal Information.  To submit such a request, please contact us using the information in the “Contact Us” section below.

  1. How to Submit a Request

You may submit a request to exercise your rights through one of two means:

  1. By filling out a Consumer Data Request Form available here.

Verification Procedures

In order to process your request to exercise your rights, we must first verify it. We do this by asking you to:

  • Provide personal identifiers we can match against information we may have collected from you previously; and
  • Confirm your request using the email and/or telephone number stated in the request; or

We will not collect additional Personal Information from you for the sole purpose of your exercising your rights under the data protection laws.  Similarly, we will not require you to create an account with us, solely for the purpose of exercising your rights under the data protection laws. 

  1. European Data Protection

If the processing of your Personal Information is subject to the EU, Swiss or UK General Data Protection Regulations (GDPR), the rights available to you depend on our reason for processing your Personal Information.  Your rights may include:

  • Access: You have the right to ask us for copies of your Personal Information subject to applicable exemptions, which means you may not always receive all the Personal Information we process.
  • Rectification: You have the right to ask us to rectify Personal Information you think is inaccurate. You also have the right to ask us to complete Personal Information you think is incomplete.
  • Erasure/deletion: You have the right to ask us to erase your Personal Information in certain circumstances.
  • Restriction of processing: You have the right to ask us to restrict the processing of your Personal Information in certain circumstances.
  • Right to object to processing:  You have the right to object to processing if we are able to process your Personal Information where the processing is in our legitimate interests.
  • Profiling: The right not to be subject to a decision based solely on automated processing, including profiling.
  • Data portability: Where you have provided us with Personal Information based on your consent, you have the right to ask that it be given to you or transferred to another organization.
  • Lodge a Complaint: You have the right to lodge a complaint with your local data protection authority if you are unhappy with any aspect of our processing of your Personal Information.

‍

You are not required to pay any charge for exercising your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. We have one month to respond to you.

For residents of France, you can send us specific instructions regarding the use of your data after your death.

To make such requests or contact our Data Protection Officer, you can follow the directions outlined in this Policy or contact us at Legal@nebula.org.

You will not have to pay a fee to access your Personal Information (or to exercise any of the other rights described above).

We may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Information (or to exercise any of your other rights). This is a security measure to ensure that your Personal Information is not disclosed to any person who has no right to receive it.

  1. GDPR Statement

This GDPR Statement applies to persons located in the European Economic Area (EEA), Switzerland and the UK. This GDPR Statement supplements our Policy; however, where the Policy conflicts with this GDPR Statement, the GDPR Statement will prevail as to persons located in the EEA, Switzerland and the UK.

Controller of your Personal Information [and local representative]

Nebula Genomics, Inc. is the controller of your Personal Information. You may contact our EU representative at Nebula.EUrep@datarologie.com. 

Our EU representative’s role in this respect is limited solely to being a contact point for questions on data protection from persons located in the EEA or UK and data protection supervisory authorities. For the avoidance of doubt, our EU representative cannot field other communications or legal process on behalf of Nebula.]

Legal basis

Pursuant to the GDPR, we will use your Personal Information in one or more of the following circumstances:
‍

  • User Data
    ‍Information Uses: For all information uses, see section “Use of Data” above.
    ‍Legal Basis: With your consent. In other cases, where we need to perform the contract we are about to enter into or have entered into with you; where it is necessary for our legitimate interests (or those of a third party) to provide or improve our Services and your interests and fundamental rights do not override that; and where we need to comply with a legal or regulatory obligation.
  • ‍Survey Data
    ‍Information Uses: For all information uses, see section “Use of Data” above.
    ‍Legal Basis: With your consent.
  • Genetic Data
    ‍Information Uses: For all information uses, see section “Use of Data” above.
    ‍Legal Basis: With your consent.
  1. How to Contact Us

You may contact Nebula or our Data Protection Officer (DPO) at: Legal@nebula.org.
Our address is: 711 Stewart Ave, Garden City, NY 11530